Ransomware showed up in 48% of all data breaches reviewed for Verizon's 2026 Data Breach Investigations Report, up from 44% a year earlier, based on more than 31,000 security incidents and over 22,000 confirmed breaches across 145 countries. Payouts are moving the other direction: 69% of victims in the same dataset refused to pay. The numbers below track where the money, and the risk, actually sit.
How many data breaches involve ransomware?
Ransomware, with or without encryption, was a factor in 48% of all breaches Verizon reviewed for its 2026 DBIR, continuing a climb that has run through every recent edition of the report. The 2025 DBIR put the figure at 44%, itself a 37% jump from the 32% recorded in the 2024 edition. Three consecutive editions of the same annual survey, drawing on tens of thousands of incidents each year, now show the same direction of travel.
Figure 1: Ransomware's share of reviewed data breaches has climbed in every recent Verizon DBIR edition. Source: Verizon 2024, 2025, and 2026 Data Breach Investigations Reports.
An outdated incident response plan or a privacy policy that has not been updated to reflect a breach notification obligation gets more expensive every year this trend continues. Ransomware is one driver behind the broader rise in reported breach volume covered in our data breach statistics for 2026.
How much do companies actually pay?
The median ransom payment in the 2026 DBIR's dataset is $139,875, which Verizon describes as a continued decline from the prior year's figure of $150,000. That said, Verizon's own 2025 DBIR had separately reported a median of $115,000 for its dataset, lower than the $139,875 figure the 2026 edition now cites as current. These self-reported payment numbers move as more incidents get confirmed and reported to insurers and negotiators, so treat any single year's median as a snapshot rather than a fixed line.
Figure 2: The FBI's narrowly defined ransomware category logs far smaller losses than its broader extortion category, largely because ransomware victims underreport losses. Source: FBI Internet Crime Complaint Center, 2024 Internet Crime Report.
IC3's own methodology note on that ransomware loss figure is blunt: the $12.47 million adjusted total "does not include estimates of lost business, time, wages, files, or equipment, or any third-party remediation services acquired by an entity," and not every victim reports a loss amount to the FBI at all, which the agency says creates an artificially low overall ransomware loss rate. The broader extortion category, which overlaps heavily with ransomware but is not identical to it, logged $143.19 million in adjusted losses from 86,415 complaints the same year. Many companies now transfer part of that ransom-payment risk to a carrier; our cyber insurance statistics for 2026 cover how much of that spending actually results in a paid claim.
Do most victims pay the ransom?
No, and the gap is widening. 69% of ransomware victims in the 2026 DBIR refused to pay, up from 64% in the 2025 DBIR and 50% two editions before that. Verizon links the decline partly to that shrinking payout figure: fewer victims are paying, which likely also helps push the median payment down.
Figure 3: The share of ransomware victims who refuse to pay has risen across three consecutive DBIR editions. Source: Verizon Data Breach Investigations Report, multiple editions.
A privacy policy generator built for current breach notification requirements does not stop an attack, but a business that already knows what it has to disclose, and to whom, spends the incident on containment instead of scrambling to figure out its own privacy policy obligations mid-crisis.
Which ransomware groups are behind the most attacks?
Akira, LockBit, RansomHub, FOG, and PLAY were the five most-reported ransomware variants to IC3 in 2024, in that order by complaint volume, according to the FBI's 2024 Internet Crime Report. LockBit's continued presence on that list comes despite a major law enforcement disruption of the group during the reporting period; IC3's report notes the FBI "dealt a serious blow to LockBit, one of the world's most active ransomware groups" in 2024, yet the group still ranked second by complaint count.
Figure 4: The payment decision most ransomware victims now face, framed around the 2026 DBIR's payout split. Source: Verizon 2026 Data Breach Investigations Report.
Since 2022, the FBI has distributed thousands of free decryption keys to ransomware victims, which the bureau says has avoided more than $800 million in payments that victims would otherwise have made.
Which organizations get hit hardest?
Ransomware is not an evenly distributed risk. Verizon's 2025 DBIR found ransomware present in 88% of breaches at small and midsize businesses, compared with 39% at larger organizations, a gap that reflects how much less spare security capacity smaller firms typically have. IC3's 2024 data adds a sector lens: the bureau logged 4,878 complaints from organizations in a critical infrastructure sector affected by a cyber threat, with ransomware and data breach the two most-reported threat types among them.
| Metric | Figure | Source |
|---|---|---|
| Share of all breaches involving ransomware (2026) | 48% | Verizon 2026 DBIR |
| Share of SMB breaches involving ransomware (2025) | 88% | Verizon 2025 DBIR |
| Share of large-org breaches involving ransomware (2025) | 39% | Verizon 2025 DBIR |
| Critical infrastructure complaints affected by cyber threats (2024) | 4,878 | FBI IC3 2024 report |
Source: Verizon Data Breach Investigations Report (2025, 2026 editions); FBI Internet Crime Complaint Center, 2024 Internet Crime Report.
Figure 5: Among the crime types IC3 tracks under its cyber threats category, data breach and ransomware complaints run nearly even, well ahead of botnet and malware reports. Source: FBI Internet Crime Complaint Center, 2024 Internet Crime Report.
A small business without dedicated security staff is, by these numbers, more likely than not to face a ransomware component the next time it has a breach at all.
The Bottom Line
Ransomware's share of data breaches has grown in three straight Verizon DBIR editions, from 32% to 44% to 48%, even as the share of victims who refuse to pay has climbed from 50% to 64% to 69% over roughly the same span. Those two trends together point to the same underlying shift: ransomware is becoming a more common part of the breach itself, but a shrinking share of that activity converts into an actual payout for attackers, which appears to be pulling the median payment down even as attack volume rises. For small and midsize businesses in particular, where Verizon's 2025 data put ransomware involvement at 88% of breaches, the practical response is less about the ransom decision and more about the incident response and disclosure plan that has to run the moment an attack starts, since a ransomware breach that exposes personal data can also trigger the kind of litigation tracked in our data breach class action settlement statistics.
Frequently Asked Questions
What percentage of data breaches involve ransomware? 48%, according to Verizon's 2026 Data Breach Investigations Report, which analyzed more than 31,000 security incidents and over 22,000 confirmed data breaches across 145 countries. That is up from 44% in the 2025 edition and 32% in the 2024 edition.
What is the median ransomware payment? $139,875, per Verizon's 2026 DBIR. That figure is down from the $150,000 median the report cites for the prior year, though Verizon's own 2025 DBIR had separately put the prior year's median at $115,000, a reminder that these self-reported payment figures get revised as more incidents are confirmed.
Do most ransomware victims actually pay? No. 69% of ransomware victims refused to pay in the 2026 DBIR's dataset, up from 64% in the 2025 edition and 50% two editions earlier.
Which ransomware groups are most active right now? Akira, LockBit, RansomHub, FOG, and PLAY were the five most-reported ransomware variants to the FBI's Internet Crime Complaint Center in 2024, ranked in that order by complaint volume.
Where the Numbers Come From
- Verizon Business. (2026). "2026 Data Breach Investigations Report." 31,000+ incidents, 22,000+ confirmed breaches, 145 countries; ransomware present in 48% of breaches, up from 44%; 69% of victims did not pay; median ransom payment $139,875.
- Verizon Business. (2025). "2025 Data Breach Investigations Report." 22,052 incidents, 12,195 confirmed breaches, 139 countries; ransomware present in 44% of breaches, up from 32%; 64% of victims did not pay; median ransom payment $115,000; ransomware in 88% of SMB breaches versus 39% of larger-organization breaches.
- Federal Bureau of Investigation, Internet Crime Complaint Center (IC3). (2025). "2024 Internet Crime Report." 3,156 ransomware complaints, $12.47 million adjusted losses; 86,415 extortion complaints, $143.19 million in losses; top ransomware variants by complaint volume: Akira, LockBit, RansomHub, FOG, PLAY; 4,878 critical infrastructure complaints affected by a cyber threat; over $800 million in avoided ransom payments since 2022 via free decryption keys.
Note: All figures verified as of September 2026. Verizon's DBIR and the FBI's IC3 Internet Crime Report are each published annually, typically in the spring, and this post's figures will be refreshed against the next editions of both.
